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Disposition of Claims 

4) [3 Claim(s) 1.2 and 4-21 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 
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Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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DETAILED ACTION 



1. 



This is in response to the amendment filed on 09/19/2007. 



2. 



Claims 1-2 and 4-21 are currently presented for the examination. 



3. 



Claims 1-2 and 4-21 have been rejected. 



Response to Arguments 



4. Objection to DRAWINGS: The applicant's arguments regarding previous objection to 
the drawings are considered, and previous objection to the drawings are withdrawn. 

5. Objection to TITLE: The title submitted on 09/19/2007 is accepted, and therefore, 
previous objection to the title is withdrawn. 

6. Objection to ABSTRACT: The abstract submitted on 09/19/2007 is accepted, and 
therefore, previous objection to the abstract is withdrawn. 

7. Objection to CLAIMS: The previous objection to claim 20 is withdrawn because of 
the amendments made to the claim. 

8. Rejection under 35 USC 1 12: The applicants arguments regarding the 35 USC 1 12 
type rejections of claims 1-20 are found persuasive, therefore, the previous 25 USC 1 12 
type rejections of claims 1-20 are withdrawn. 

9. Rejection under 35 USC 101: The applicant's arguments regarding the 35 USC 101 
type rejections of claims 1-11 and 15-17 are found persuasive, therefore, the previous 25 
USC 101 type rejections of claims 1-11 and 15-17 are withdrawn. 
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10. Rejection under 35 USC 102 (b) : The applicant's arguments regarding the 35 USC 
102 (b) type rejections of claims 1-20 are found persuasive, however, these arguments are 
now moot in view of new grounds of rejection presented in this office action (please see 
below for detail). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that 
the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

11. Claims 1-2, 4-10 and 12-21 are rejected under 35 USC 103 (a) as being 
unpatentable over Hvpponen et al (US 6577920 Bl) in view of Kephart et al (US 567571 1). 

Regarding claim 1, Hvpponen et al discloses a method of detecting a non-virus 
component in a virus-protected computer system having antivirus software comprising: 
identifying a software trace of the non-virus component (Col 2, starting at line 24; Col 3, 
starting at line 34; screening; identifying signature indicative of virus free macros ; virus 
free macros are interpreted as non- virus software trace ) and conveying the trace to the 
computer system as a virus pseudo-signature to allow detection of the component by the 
system's antivirus software (Col 2, starting at line 24; Col 5, starting at line 10; sending/ 
conveying macro signatures from network manager to user; scanning/ screening for virus 
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free macros) ; wherein the component is a hardware device (Col 2, starting at line 24; 
memory for storing signatures). 

Hypponen et al fails to disclose wherein the software trace is indicative of the 
presence of the hardware device in the computer system. 

However, Kephartetal discloses wherein the software trace is indicative of the 
presence of the hardware device in the computer system (Fig 4; Col 10, starts at line 20; 
determining 'pseudo' non- viral boot sector). Kephart et al further discloses identifying a 
software trace of the non-virus component and conveying the trace to the computer system 
as a virus pseudo-signature to allow detection of the component by the system's antivirus 
software ( Col 8, starting at line 60; pseudo/ non-viral features). 

Kephart et al and Hypponen et al are analogous art because they are from the same 
field of endeavor of virus signature system . At the time of invention it would have been 
obvious to a person of ordinary skill in the art to combine the teachings of Kephart et al 
with Hypponen et al to design a method further including wherein the (pseudo) software 
trace is indicative of the presence of the hardware device in the computer system in order to 
provide further hardware specific security. 

Regarding claim 12, it is rejected applying as above rejecting claim 1, furthermore, 
Hypponen et al discloses a method of detecting, in a virus-protected computer system, the 
presence of a non-virus component comprising receiving a virus pseudo-signature associated 
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with a software trace of the non-virus component (Col 2, starting at line 24; Col 3, starting- at- 
line 34; screening; identifying signature indicative of virus free macros), and comparing the 
pseudo-signature with software traces disposed within the system's memory (Col 3, starting 
at line 34; determining). 

Hypponen et al fails to disclose wherein the software trace is indicative of the 
presence of the hardware device in the computer system. 

However, Kephartetal discloses wherein the software trace is indicative of the 
presence of the hardware device in the computer system (Fig 4; Col 10, starts at line 20; 
determining 'pseudo' non-viral boot sector). Kephart et al further discloses identifying a 
software trace of the non- virus component and conveying the trace to the computer system 
as a virus pseudo-signature to allow detection of the component by the system's antivirus 
software ( Col 8, starting at line 60; pseudo/ non-viral features). 

Regarding claim 14, it is rejected applying as above rejecting claim 1, furthermore, 
Hypponen et al discloses an apparatus for detecting, in a virus-protected computer system, a 
non-virus component, comprising a pseudo-signature generation element operative to 
produce a software trace of the component (Col 1, starting at line 65; Col 4, starting at line 
50; signature/ checksum calculation), and an antivirus support source whereby the software 
trace may be conveyed, as a virus pseudo-signature, to the computer system (Col 2, starting 
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at line 24; Col 3, starting at line 34; screening; identifying signature indicative of virus free 
macros). 

Hypponen et al fails to disclose wherein the software trace is indicative of the 
presence of the hardware device in the computer system. 

However, Kephartetal discloses wherein the software trace is indicative of the 
presence of the hardware device in the computer system (Fig 4; Col 10, starts at line 20; 
determining 'pseudo' non-viral boot sector). Kephart et al further discloses identifying a 
software trace of the non-virus component and conveying the trace to the computer system 
as a virus pseudo-signature to allow detection of the component by the system's antivirus 
software ( Col 8, starting at line 60; pseudo/ non-viral features). 

Regarding claim 21, it is rejected applying as above rejecting claim 1, furthermore, 
Hy pponen et al discloses a method of system of detecting a non-virus component in a virus- 
protected computer system having antivirus software comprising: 

means for identifying a software trace indicative of the presence of a hardware device 
in the computer system; and 

means for conveying the trace to the computer system as a virus pseudo-signature to 
allow detection of the device by the system's antivirus software (Col 2, starting at line 24; 
Col 3, starting at line 34), 
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wherein the trace is conveyed to the computer system as part of an update procedure 
(Col 2, starting at line 24; Col 5, starting at line 10), 

whereby additional virus signatures or scanning engines may also be passed to the 
antivirus software (Col 2, starting at line 24; Col 5, starting at line 10). 

Hypponen et al fails to disclose means for identifying a software trace indicative of 
the presence of a hardware device in the computer system. 

However, Kephartetal discloses means for identifying a software trace indicative of 
the presence of a hardware device in the computer system (Fig 4; Col 10, starts at line 20; 
determining 'pseudo 5 non-viral boot sector). 

Regarding claim 2, Hypponen et al discloses a method wherein the trace is 
conveyed to the computer system as part of an update procedure, whereby additional virus 
signatures or scanning engines may also be passed to the antivirus software (Col 2, starting at 
line 24; updating databases with macro signatures ). Furthermore, Kephartetal discloses 
method wherein the trace is conveyed to the computer system as part of an update 
procedure, whereby additional virus signatures or scanning engines may also be passed to the 
antivirus software (Col 10, starts at line 20; plurality of pseudo viral features/ Vectors). 
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Regarding claim 4, Hypponen et al discloses a method wherein the software trace is 
resident in a volatile area of the system's memory (Col 3, starting at line 34; memory storing 
signatures indicative of virus free macros). Furthermore, Kephartetal discloses wherein the 
software trace is resident in a volatile area of the system's memory (Col 10, starts at line 20; 
boot sector). 

Regarding claim 5, Hypponen et al discloses a method wherein the pseudo-signature 
is tagged or otherwise marked to distinguish it from authentic virus signatures (Col 3, 
starting at line 2; certified/ set of signatures indicative of virus free macros) . Furthermore, 
Kephartetal discloses wherein the pseudo-signature is tagged or otherwise marked to 
distinguish it from authentic virus signatures (Col 10, starts at line 20; classifier for pseudo 
non-viral, and viral features) 

Regarding claim 6, Hy pponen et al discloses a method wherein the antivirus 
software is modified so as to react differently to the presence of pseudo and authentic virus 
signatures (Col 1, starting at line 63; each micro having signature/ checksum). 

Regarding claim 7, Hypponen et al discloses a method wherein the modification is 
effected as part of the update procedure (Col 2, starting at line 24; updating; macro 
signatures). 
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Regarding claim 8, Hypponen et al discloses a method wherein the antivirus 
software does not attempt to fix, clean, modify or delete the component associated with the 
pseudo-signature ( Col 5, starting at line 15; only manager has authority to modify signature 
database). 

Regarding claim 9, Hypponen et al discloses a method wherein detection of the 
pseudo-signature causes an advisory message to be conveyed to a user of the system, 
advising the user of the presence of the detected component (Col 3, starting at line 23; 
alerting). 

Regarding claim 10, Hypponen et al discloses a method wherein detection of the 
pseudo-signature effects a connection to a website providing details of the component 
concerned (Col 3, starting at line 1; central site). 

Regarding claim 13, Hypponen et al discloses a method wherein, in the event of a 
match being found, the antivirus software of the system is operative to convey, to a user of 
the system, an advisory message advising of the presence of the detected non-virus 
component (Col 3, starting at line 23; alerting). 

Regarding claims 15 and 18, they recite the limitations of claims 1-2 and 4-14, 
therefore, they are rejected applying as above rejecting claims 1-2 and 4-14. 
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Regarding claims 16-17 and 19-20, they recite the limitations of claims 1-2, 5-6 and 
12, therefore, they are rejected applying as above rejecting claims 1-2, 5-6 and 12. 

12. Claim 1 1 is rejected under 35 USC 103 (a) as being unpatentable over Hy pponen et 
al (US 6577920 Bl) in view of Kephart et al (US 567571 1) further in view of Muttik et al 
(US 6963978 Bl). 

Regarding claim 11, Hypponen et al discloses a method of facilitating the detection 
of a non-virus component in a first virus-protected computer system comprising: 
identifying, on a second computer system, a software trace of the non-virus the component 
(Col 2, starting at line 47; Col 4, line 50 to Col 5, line 22; network manager, or controller 
scanning or sending virus signatures to host/ end user application), and conveying the trace 
towards an antivirus update source whereby the software trace may be passed, as a virus 
pseudo-signature, to the first computer system (Col 2, starting at line 24; updating databases 
with macro signatures; relaying to the end user computer signature indicative of virus free 
macros); wherein the component is a hardware device (Col 2, starting at line 24; memory for 
storing signatures). 

Hypponen et al fails to disclose wherein the software trace is indicative of the 
presence of the hardware device in the computer system. 
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However, Kephartetal discloses wherein the software trace is indicative of the ' 
presence of the hardware device in the computer system (Fig 4; Col 10, starts at line 20; 
determining 'pseudo' non-viral boot sector). Kephart et al further discloses identifying a 
software trace of the non-virus component and conveying the trace to the computer system 
as a virus pseudo-signature to allow detection of the component by the system's antivirus 
software ( Col 8, starting at line 60; pseudo/ non-viral features). 

In the case, grounds for the inherency of first and second computer system are found 
not to be supportable, Muttiketal discloses identifying, on a second computer system, a 
software trace of the non- virus the component and conveying the trace towards an antivirus 
update source whereby the software trace may be passed, as a virus pseudo-signature, to the 
first computer system ( Fig 3-6; Col 6, line 1 -Col 8, line 67; transmitting fingerprinting of 
innocent data; client-server environment). 

Muttik et al , Kephart et al and Hypponen et al are analogous art because they are 
from the same field of endeavor of virus signature system . At the time of invention it 
would have been obvious to a person of ordinary skill in the art to combine the teachings of 
Kephart et al and/ or Muttik et al w ith Hypponen et al to design a method further 
including wherein identifying, on a second computer system, a software trace of the non- 
virus the component and conveying the trace towards an antivirus update source whereby 
the software trace may be passed, as a virus pseudo-signature, to the first computer system in 
order to facilitate network anitvirus updating. 
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Conclusion 

1 3 . Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is 
reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened statutory 
period will expire on the date the advisory action is mailed, and any extension fee pursuant 
to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. See 
MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for response to this action is set to expire in 3 (Three) 
months and 0 (Zero) days from the mailing date of this letter. Failure to respond within the 
period for response will result in ABANDOMENT of the application (see 35 U.S. C 133, 
M.P.E.P 710.02(b)). 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shanto M Z Abedin whose telephone number is 571-272- 
3551, and fax number is 571-273-3551. The examiner can normally be reached on M-F 
from 9:00 AM to 5:30 PM. If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Moazzami Nasser, can be reached on 571-272-4195. For more 
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information about the PAIR system, see http://pair-direct.uspto.gov. Should you have 
questions on access to the Private PAIR system, contact the Electronic Business Center 
(EBC) at 866-217-9197 (toll-free). 

Shanto M Z Abedin 

Examiner, 2136 J^iSSS^R 

^SSSSS CENTER 2100 



